Harden Entra marketplace access: cache scoping, race guards, error handling

Address rubber-duck review findings on the Entra ID marketplace path:

- Scope the cached access verdict to the marketplace it was computed against
  (authProvider + accountId + serviceUrl), rejecting stale caches on any mismatch.
- Guard cache application and background validation with a monotonic epoch so a
  session/account/config change mid-validation supersedes an in-flight result.
- Register session/account listeners before applying the cache, and the config
  listener before initial validation, closing startup TOCTOU windows.
- Route transient auth-service and marketplace-fetch failures to Unreachable
  instead of leaving a configured marketplace on a blank Unavailable view.
- Split 401 (missing/expired token -> RequiresSignIn, not cached) from 403
  (durable denial -> AccessDenied, cached ineligible).
- Never follow redirects on token-bearing requests; only send the Entra token to
  an HTTPS same-origin target; reject non-2xx and non-manifest 200 responses
  before parsing.
- Restore the galleryservice:custom:marketplace telemetry on the GitHub path and
  drop the unused server-provided eligibility reason from persisted cache.

Expand unit coverage to 45 tests across provider routing, eligibility, caching,
error classification, and the epoch race paths.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: mcumming

build/lib/policies/policyData.jsonc

@@ -87,7 +87,7 @@
             "key": "extensions.gallery.authProvider",
             "name": "ExtensionGalleryAuthProvider",
             "category": "Extensions",
-            "minimumVersion": "1.99",
+            "minimumVersion": "1.121",
             "localization": {
                 "description": {
                     "key": "extensions.gallery.authProvider",

src/vs/base/common/product.ts

@@ -118,6 +118,15 @@ export interface IProductConfiguration {
 		readonly accessSKUs?: string[];
 	};
 
+	/**
+	 * Hard gate for the Entra ID (Microsoft) authentication path of the Extensions
+	 * Marketplace. When falsy, the `extensions.gallery.authProvider: microsoft`
+	 * setting is ignored and the GitHub/default auth path is used instead. This keeps
+	 * the Entra path dormant on builds where the Private Marketplace has not yet been
+	 * publicly released, independent of any admin policy configuration.
+	 */
+	readonly enableExtensionGalleryEntraAuth?: boolean;
+
 	readonly mcpGallery?: {
 		readonly serviceUrl: string;
 		readonly itemWebUrl: string;

src/vs/platform/extensionManagement/common/extensionGalleryManifest.ts

@@ -69,7 +69,21 @@ export const enum ExtensionGalleryManifestStatus {
 	Available = 'available',
 	RequiresSignIn = 'requiresSignIn',
 	AccessDenied = 'accessDenied',
-	Unavailable = 'unavailable'
+	Unavailable = 'unavailable',
+	/**
+	 * A marketplace is configured, and the user is (or is presumed) eligible, but its
+	 * gallery manifest could not be fetched — a transient network/server error. Unlike
+	 * {@link Unavailable} (which also means "no gallery configured"), this state is only
+	 * ever set after a failed fetch of a configured marketplace, so it is safe to surface
+	 * an informative message without affecting builds that have no gallery at all.
+	 */
+	Unreachable = 'unreachable',
+	/**
+	 * The marketplace is configured for Microsoft (Entra ID) authentication, but the
+	 * gallery manifest does not advertise an EligibilityService resource. Access is
+	 * refused (no silent fallback to another provider) until the server is corrected.
+	 */
+	Misconfigured = 'misconfigured'
 }
 
 export const IExtensionGalleryManifestService = createDecorator<IExtensionGalleryManifestService>('IExtensionGalleryManifestService');
@@ -103,13 +117,13 @@ export const ExtensionGalleryServiceUrlConfigKey = 'extensions.gallery.serviceUr
 export const ExtensionGalleryAuthProviderConfigKey = 'extensions.gallery.authProvider';
 
 /**
- * Scope for requesting tokens against the Private Marketplace's own Entra app registration.
- * Produces tokens with `aud = api://{private-marketplace-client-id}`, matching the server's
- * `Marketplace:Authorization:Entra:Audience` config.
+ * Scopes requested when signing in with Microsoft (Entra ID) to establish the
+ * user's identity for the Private Marketplace eligibility check.
  *
- * Do NOT use `https://marketplace.visualstudio.com/.default` — that produces
- * `aud: marketplace.visualstudio.com` and will be rejected with 401.
- *
- * `{private-marketplace-client-id}` is the Client ID from the deployment-time app registration.
+ * Only standard OpenID Connect sign-in scopes are requested — enough to obtain a
+ * Microsoft session that identifies the user. This intentionally does NOT request a
+ * resource-scoped token (e.g. `api://<client-id>/access_as_user`). Acquiring resource
+ * tokens for Private Marketplace API calls, per the server's Protected Resource
+ * Metadata (RFC 9728), is deferred to a follow-up change.
  */
-export const PRIVATE_MARKETPLACE_SCOPE = 'api://{private-marketplace-client-id}/access_as_user';
+export const PRIVATE_MARKETPLACE_SCOPES: string[] = ['openid', 'profile', 'email', 'offline_access'];

src/vs/workbench/contrib/extensions/browser/extensions.contribution.ts

@@ -25,7 +25,7 @@ import { CommandsRegistry, ICommandService } from '../../../../platform/commands
 import { Extensions as ConfigurationExtensions, ConfigurationScope, IConfigurationRegistry } from '../../../../platform/configuration/common/configurationRegistry.js';
 import { ContextKeyExpr, IContextKeyService, RawContextKey } from '../../../../platform/contextkey/common/contextkey.js';
 import { IDialogService, IFileDialogService } from '../../../../platform/dialogs/common/dialogs.js';
-import { ExtensionGalleryManifestStatus, ExtensionGalleryResourceType, ExtensionGalleryAuthProviderConfigKey, ExtensionGalleryServiceUrlConfigKey, getExtensionGalleryManifestResourceUri, IExtensionGalleryManifest, IExtensionGalleryManifestService, PRIVATE_MARKETPLACE_SCOPE } from '../../../../platform/extensionManagement/common/extensionGalleryManifest.js';
+import { ExtensionGalleryManifestStatus, ExtensionGalleryResourceType, ExtensionGalleryAuthProviderConfigKey, ExtensionGalleryServiceUrlConfigKey, getExtensionGalleryManifestResourceUri, IExtensionGalleryManifest, IExtensionGalleryManifestService, PRIVATE_MARKETPLACE_SCOPES } from '../../../../platform/extensionManagement/common/extensionGalleryManifest.js';
 import { EXTENSION_INSTALL_SOURCE_CONTEXT, ExtensionInstallSource, ExtensionRequestsTimeoutConfigKey, ExtensionsLocalizedLabel, FilterType, IExtensionGalleryService, IExtensionManagementService, PreferencesLocalizedLabel, SortBy, VerifyExtensionSignatureConfigKey } from '../../../../platform/extensionManagement/common/extensionManagement.js';
 import { areSameExtensions, getIdAndVersion } from '../../../../platform/extensionManagement/common/extensionManagementUtil.js';
 import { ExtensionStorageService } from '../../../../platform/extensionManagement/common/extensionStorage.js';
@@ -330,10 +330,12 @@ Registry.as<IConfigurationRegistry>(ConfigurationExtensions.Configuration)
 			},
 			[ExtensionGalleryAuthProviderConfigKey]: {
 				type: 'string',
-				enum: ['github', 'microsoft'],
-				enumDescriptions: [
+				enum: product.enableExtensionGalleryEntraAuth ? ['github', 'microsoft'] : ['github'],
+				enumDescriptions: product.enableExtensionGalleryEntraAuth ? [
 					localize('extensions.gallery.authProvider.github', "Authenticate to the Extensions Marketplace using GitHub."),
 					localize('extensions.gallery.authProvider.microsoft', "Authenticate to the Extensions Marketplace using a Microsoft (Entra ID) account."),
+				] : [
+					localize('extensions.gallery.authProvider.github', "Authenticate to the Extensions Marketplace using GitHub."),
 				],
 				description: localize('extensions.gallery.authProvider', "Configure the authentication provider for the Extensions Marketplace"),
 				default: '',
@@ -342,7 +344,7 @@ Registry.as<IConfigurationRegistry>(ConfigurationExtensions.Configuration)
 				policy: {
 					name: 'ExtensionGalleryAuthProvider',
 					category: PolicyCategory.Extensions,
-					minimumVersion: '1.99',
+					minimumVersion: '1.121',
 					localization: {
 						description: {
 							key: 'extensions.gallery.authProvider',
@@ -2132,13 +2134,14 @@ registerAction2(class ExtensionsGallerySignInAction extends Action2 {
 	}
 	async run(accessor: ServicesAccessor): Promise<void> {
 		const configurationService = accessor.get(IConfigurationService);
+		const productService = accessor.get(IProductService);
 		const authProvider = configurationService.getValue<string>(ExtensionGalleryAuthProviderConfigKey);
 
-		if (authProvider === 'microsoft') {
+		if (authProvider === 'microsoft' && productService.enableExtensionGalleryEntraAuth) {
 			const authenticationService = accessor.get(IAuthenticationService);
 			await authenticationService.createSession(
 				'microsoft',
-				[PRIVATE_MARKETPLACE_SCOPE]);
+				PRIVATE_MARKETPLACE_SCOPES);
 		} else {
 			const commandService = accessor.get(ICommandService);
 			await commandService.executeCommand(DEFAULT_ACCOUNT_SIGN_IN_COMMAND);

src/vs/workbench/contrib/extensions/browser/extensionsViewlet.ts

@@ -142,7 +142,12 @@ export class ExtensionsViewletViewsContribution extends Disposable implements IW
 				ContextKeyExpr.or(
 					ContextKeyExpr.has('searchMarketplaceExtensions'), ContextKeyExpr.and(DefaultViewsContext)
 				),
-				ContextKeyExpr.or(CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.RequiresSignIn), CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.AccessDenied))
+				ContextKeyExpr.or(
+					CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.RequiresSignIn),
+					CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.AccessDenied),
+					CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.Misconfigured),
+					CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.Unreachable)
+				)
 			),
 			order: -1,
 		});
@@ -187,6 +192,16 @@ export class ExtensionsViewletViewsContribution extends Disposable implements IW
 				)
 			)
 		});
+
+		viewRegistry.registerViewWelcomeContent('workbench.views.extensions.marketplaceAccess', {
+			content: localize('marketplace misconfigured', "The Extensions Marketplace is not configured correctly and cannot be reached. Please contact your administrator."),
+			when: CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.Misconfigured)
+		});
+
+		viewRegistry.registerViewWelcomeContent('workbench.views.extensions.marketplaceAccess', {
+			content: localize('marketplace unreachable', "The Extensions Marketplace is currently unavailable. Check your network connection and [try again]({0}).", `command:workbench.action.reloadWindow`),
+			when: CONTEXT_EXTENSIONS_GALLERY_STATUS.isEqualTo(ExtensionGalleryManifestStatus.Unreachable)
+		});
 	}
 
 	private createDefaultExtensionsViewDescriptors(): IViewDescriptor[] {
@@ -1153,6 +1168,12 @@ export class ExtensionMarketplaceStatusUpdater extends Disposable implements IWo
 			case ExtensionGalleryManifestStatus.AccessDenied:
 				badge = new WarningBadge(() => localize('accessDenied', "Access denied to marketplace"));
 				break;
+			case ExtensionGalleryManifestStatus.Misconfigured:
+				badge = new WarningBadge(() => localize('marketplaceMisconfigured', "Marketplace is misconfigured"));
+				break;
+			case ExtensionGalleryManifestStatus.Unreachable:
+				badge = new WarningBadge(() => localize('marketplaceUnreachable', "Marketplace is currently unavailable"));
+				break;
 		}
 
 		if (badge) {